Gift card scam uses boss’ email address

Sometimes it’s good to question the boss.

If you get an email from your boss asking you to purchase gift cards, you may really be communicating with scammers.

For the past six months or so, there’s been an email scam from “bosses” requesting that you purchase gift cards on their behalf. It’s a more sophisticated version of the traditional email phishing scam in that scammers research the name of the CEO, department head, or boss, and pretend to be them when they contact staff members.

These phishing requests can be lucrative for scammers – they generally ask the victim to purchase cards totaling $1,200 to $2,000, and then ask for the codes from the back of the cards. Once they have the codes, the money is theirs. Gift cards are liquid and hard to trace, which means you will most likely not get your money back.

Here is an example of an exchange:

It’s not odd for employees to get real emails like this from the boss. As an employee, you want to help out, so you may not think to recheck the request.

What should you do before purchasing gift cards for your boss?

1. Scrutinize the email and look for red flags:

Look for uncharacteristic wording, grammar and spelling mistakes, or an email address that doesn’t match your company’s email addresses, for instance (Joe Smith [mailto:exec@aol.com] instead of [joe@WinnipegCompany.com]). Note that the scammers can sometimes also mimic email addresses correctly.

2. Contact your employer using another form of communication:

The best way is to pick up the phone and confirm the request. You can also communicate using a text message, Microsoft Teams, or start a new email with your manager to confirm whether the email is real.

What should you do as a boss to make employees aware of phishing attacks?

There are two steps you can take:

1. Email your employees when you are aware of a scam/phishing attack:

For instance:

Beware of a new email phishing attack that requests you to purchase gift cards on behalf of your manager. The email asks recipients to purchase gift cards, scratch them, and email the code numbers back to your manger. Never comply with such requests without confirming with your manager that it’s not a scam – by phone, text, or starting a new email conversation.

2. Provide employee security awareness training:

Help your employees take the right steps to ensure they and your organization are safe from phishing attacks. Contact Michael Anderson to schedule a security-awareness workshop.

If you have questions about your organization’s security, contact Michael Anderson.

And don’t be afraid to question the boss.